Tools

The five built-in tools the agent uses.

Five built-in tools. Zero ceremony. The minimum viable toolbox for an agent that actually ships code.

Tool	What it does
`read`	Read text files, or render PNG / JPG / GIF / WebP inline on modern terminals.
`write`	Create or overwrite files, making parent directories as needed.
`edit`	One or more exact-match replacements in an existing file.
`glob`	Find files matching patterns such as */.go or src/*/.ts. Searches recursively, honors root and nested .gitignore rules, excludes hidden paths by default, and respects jail mode.
`bash`	Run a command in the session cwd with merged stdout/stderr and a timeout. On Unix, zot uses /bin/bash when available, then Bash from PATH, and falls back to POSIX /bin/sh. On Windows, it uses cmd /C.

Jail mode

Type /jail to confine every tool to the current directory for this session, or enable jail new sessions by default in /settings to apply it across launches. Bash refuses sudo, rm -rf /, other obvious escape patterns, and path arguments or redirections that resolve outside the sandbox. It is a guardrail against accidents, not a hard security boundary. See Jail mode for the full behavior.

Shell escape

Type ! followed by a command to run it straight in your shell, no model call involved: !mkdir foo, !git status, !ls -la.

Everything after the ! is passed to the same shell the bash tool uses (/bin/bash -c when available on Unix, then bash -c from PATH, with POSIX /bin/sh -c as a fallback; cmd /C on Windows), runs in the session working directory, and honors the /jail sandbox. macOS ships Bash 3.2 by default, so newer Bash features may be unavailable. The command, merged output, and exit status are appended to the transcript as user context, so the model can use them on the next turn. Running the command does not itself start a model turn. A running !command shares the busy state with the agent: esc cancels it, and you cannot start one while a turn (or another shell escape) is in flight.